22,161 Hotmail Accounts Quietly Leaked via Telegram Channel

In late December 2024, a Telegram user uploaded a stealer log labeled "Good Hotmail", exposing 22,161 records of email addresses, plaintext passwords, and the URLs of the login pages where the credentials were captured. The "good" tag is a claim by the uploader that the logins were verified as working, making this batch especially attractive to other criminals browsing the channel.

This is not a breach of Microsoft's Hotmail or Outlook systems. It is a stealer log, a collection of credentials pulled from malware-infected devices, packaged and shared because the victims happened to have Hotmail accounts saved on their machines.

Why This Stealer Log Is Dangerous

With 22,161 records, this is a sizable batch, and every password in it was stored and shared as plain, readable text. Nothing needs to be decrypted or cracked. Anyone with the file can start testing logins the moment they download it, and because the data was tagged as verified, criminals are likely to prioritize it over unverified dumps.

What Was Exposed

• Email addresses (Hotmail accounts)
• Plaintext passwords
• URLs of the login pages where the credentials were captured

Why This Matters for You

A working email and password combination is worth far more to a criminal than just access to your inbox. These lists get run through credential stuffing tools that automatically try the same login on banking, shopping and social media sites, since password reuse is so common. A hijacked Hotmail account can also be used to intercept password reset emails for other services, leading straight to account takeover, identity theft and financial fraud.

How Stealer Logs Like This One Work

Infostealer malware typically spreads through cracked software, fake downloads or malicious attachments. Once installed, it quietly copies saved passwords, autofill fields and session cookies from the victim's browser, then sends everything back to the attacker. The stolen data is sorted, labeled as "good" if the logins still work, and distributed through Telegram channels like this one.

Check If You Are Affected

HEROIC's database holds over 400 billion compromised records, so checking your exposure only takes a moment. Run your email address through HEROIC's free breach scanner to see if your Hotmail account, or any other account, was part of this leak, and update any passwords you have reused elsewhere.